PT-2017-16721 · Openvpn · Openvpn Access Server

Julien Boulet · Published 2017-05-25 · Updated 2017-06-06 · CVE-2017-5868

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server version 2.1.4

Description A CRLF injection issue in the web interface allows remote attackers to inject arbitrary HTTP headers, potentially leading to session fixation attacks and HTTP response splitting attacks. This is achieved by including "%0A" characters in the PATH INFO to session start /.

Recommendations For OpenVPN Access Server version 2.1.4, update to a newer version that contains a fix for this issue to prevent CRLF injection attacks. As a temporary workaround, consider restricting access to the session start / endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2017-5868

Affected Products

Openvpn Access Server

References · 5

• 🔥 https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation · Exploit
• 🔥 http://openwall.com/lists/oss-security/2017/05/23/13 · Exploit
• https://osv.dev/vulnerability/CVE-2017-5868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5868 · Security Note
• http://securitytracker.com/id/1038547 · Note